Re: I-D Action: draft-smith-6man-link-locals-off-link-00.txt

[Mark Smith <[e-mail]>]

Hi Dennis,

On 22 August 2015 at 01:09, Dennis Ferguson <[e-mail]> wrote:
> Mark,
>
> On 20 Aug, 2015, at 03:02 , Mark Smith <[e-mail]> wrote:
>> What I'm really taking about is whether a host can reach a link local destination attached to the same link instance directly.
>
> Here's the definition of "link" from RFC2460:
>
>    link        - a communication facility or medium over which nodes can
>                  communicate at the link layer, i.e., the layer
>                  immediately below IPv6.  Examples are Ethernets (simple
>                  or bridged); PPP links; X.25, Frame Relay, or ATM
>                  networks; and internet (or higher) layer "tunnels",
>                  such as tunnels over IPv4 or IPv6 itself.
>
> Given this I think your statement of the problem is really difficult to parse.
> Hosts attached to the same link can communicate directly at the link layer.
> Hosts that can't communicate directly at the link layer are not attached to
> the same link.
>  Link local addresses may only be used to communicate with
> nodes attached to the same link which, by definition, can be reached directly
> at the link layer.
>

Here's a definition from RFC4861 that describes the characteristics of
a CBMA-type link from the perspective of IPv6 neighbor reachability.

   shared media   - a link that allows direct communication among a
                    number of nodes, but attached nodes are configured
                    in such a way that they do not have complete prefix
                    information for all on-link destinations.  That is,
                    at the IP level, nodes on the same link may not know
                    that they are neighbors; by default, they
                    communicate through a router.  Examples are large
                    (switched) public data networks such as Switched
                    Multimegabit Data Service (SMDS) and Broadband
                    Integrated Services Digital Network (B-ISDN).  Also
                    known as "large clouds".  See [SH-MEDIA].


Note, "That is, at the IP level, nodes on the same link may not know
that they are neighbors; by default, they communicate through a
router."

This is what allows GUAs and ULAs to work over a CBMA link if the
L-bit is switched off for their PIOs. The trouble is that currently it
isn't possible for Link-Local's to be used over 'shared media' links
with CMBA reachability limitations, because hosts always consider LL
destinations to be "on-link" (per RFC5942).

It seems really inconsistent to me that GUAs and ULAs will work over
these types of links by default (due to the default "off-link"
assumption for those prefixes), where as LLs won't, but more
importantly, LLs can't be made to work even if desired, despite LLs
being a more preferred address type to use vs. GUA/ULAs, as per the
IPv6 address selection rules.

I'm fine with security being a reason to limit this reachability.
However, I think the absoluteness of the LLs not and currently never
working over CBMA type links should be changed, allowing more granular
security to be applied to LL traffic over CBMA links if desired.

Regards,
Mark.

> If you restrict the link layer connectivity of a host you have unavoidably
> restricted the scope of the link to which it is attached to the neighbors it
> can still reach directly at the link layer.   If a host thinks it should be
> able to reach a link local destination that it cannot communicate with at
> the (restricted) link layer you have a problem, but it is not a problem you
> can fix with a router.  You instead need to fix whatever it is that lead the
> host to think that would work.
>
> This is why the question of how the host came to know the off-link link local
> address is exactly on target; the answer would reveal what needs to be
> fixed.  I don't think you have answered this question yet.  If there is no
> answer to this there may be no problem to fix.
>
> Dennis Ferguson
>